Published: 18/03/2022 Updated: 28/03/2022

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

Vulnerable Product	Search on Vulmon	Subscribe to Product
digitalbazaar forge

Synopsis Moderate: Red Hat OpenShift Service Mesh 2121 containers security update Type/Severity Security Advisory: Moderate Topic An update for is now available for OpenShift Service Mesh 21Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Important: Service Registry (container images) release and security update [230GA] Type/Severity Security Advisory: Important Topic An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog The purpose of this text-only errata is to inform you about the security issues fi ...

Synopsis Moderate: Red Hat Advanced Cluster Management 244 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 244 GeneralAvailability release images This update provides security fixes, bug fixes, and updates container imagesRed Hat Product Security has rated ...

Synopsis Important: Red Hat OpenShift Data Foundation 4110 security, enhancement, & bugfix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4110 on Red Hat Enterprise Linux 8Red Hat Product Securit ...

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript Prior to version 130, RSA PKCS#1 v15 signature verification code does not properly check `DigestInfo` for a proper ASN1 structure This can lead to successful verification with signatures that contain invalid structures but a valid digest The ...

CWE-347 https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1 https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2022:1739

CVE-2022-24773

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect